CISA Cheat Sheet.
The night-before summary, built like the exam.

CISA Exam Logistics At-a-Glance

Why the Scaled Score Matters

• ISACA reports results on a 200-800 scaled range rather than raw percent correct, so a 450 is not "56%" in any simple sense — treat it as a pass/fail threshold, not a percentage target.
• Because scaling normalizes difficulty across exam forms, don't try to reverse-engineer how many raw questions you can miss; focus study time proportionally to domain weight instead.

The Five CISA Content Domains

The exam content outline that took effect 1 August 2024 organizes all tested material into five job practice domains. Memorize the order and weights — weight roughly predicts how many of the 150 questions come from each domain.

1. Domain 1 — Information Systems Auditing Process (18%)
2. Domain 2 — Governance and Management of IT (18%)
3. Domain 3 — Information Systems Acquisition, Development and Implementation (12%)
4. Domain 4 — Information Systems Operations and Business Resilience (26%)
5. Domain 5 — Protection of Information Assets (26%)

The Domain-Weight Trap

• Domains 4 and 5 together make up 52% of the exam — over half your questions come from just two domains, so under-studying operations/resilience and information-asset protection is the single biggest scoring risk.
• Domain 3 (systems acquisition/development) has the lowest weight at 12%, but candidates from a pure-audit background often over-invest here relative to its payoff — budget study time by weight, not by comfort level.
• Domains 1 and 2 are tied at 18% each; many candidates assume the "process" domain (1) is the biggest because it's listed first — it is not.

Key Terms and Concepts to Memorize

• IS Audit Process — risk-based audit planning, evidence gathering, audit standards/guidelines, and communicating results to stakeholders.
• IT Governance — the difference between governance (setting direction/oversight) and management (day-to-day execution); IT strategy alignment with enterprise goals; enterprise risk management frameworks.
• SDLC controls — control points across the systems development life cycle, project governance, change management, and post-implementation review.
• Business resilience — business continuity planning (BCP) vs. disaster recovery planning (DRP), RTO/RPO concepts, incident management, and IT operations controls (job scheduling, capacity, problem management).
• Information asset protection — security architecture, identity and access management, network/endpoint security, encryption fundamentals, and data classification/privacy controls.
• Auditor mindset questions — CISA scenario questions frequently reward the answer that reflects what an auditor should recommend or do first, not necessarily the most technically correct security fix.

Common Gotchas and Traps

• ISACA exam questions often present several technically true answers — the correct choice is the best or first action from an audit/risk perspective, not merely a valid one.
• Watch for questions that test whether you know an auditor's role is independent evaluation and reporting, not implementing fixes — answers that have the auditor "fix" a control are usually traps.
• Don't confuse governance-level concerns (policy, oversight, risk appetite) with management-level or operational-level concerns; ISACA question stems often hinge on which organizational level should act.
• The revised exam content outline places increased emphasis on risk, security, and controls tied to disruptive/emerging technologies — don't assume the exam is only about legacy IT audit topics.
• Remember the CISA credential itself requires ongoing Continuing Professional Education (CPE) after certification — passing the exam is the first step, not the end state, and this distinction sometimes appears in eligibility-focused review questions.

Night-Before Checklist

• Confirm your testing modality (in-person PSI test center vs. remote online proctoring) and verify the exact appointment time and location or system requirements.
• Bring required government-issued photo ID matching your registration name exactly.
• Review the domain weight table one final time — mentally re-rank Domains 4 and 5 as your highest-yield review areas since together they cover 52% of content.
• Do a light pass on terminology you still hesitate on: governance vs. management, BCP vs. DRP, RTO vs. RPO, and audit independence principles.
• Plan for the full 240-minute session — eat beforehand and avoid over-caffeinating; there is no traditional scheduled break built into a fixed-length CBT session, so pace yourself across all 150 questions.
• Remind yourself of the pass threshold: a scaled score of 450+ is the goal — don't let anxiety over any single hard question derail your pacing on the rest.
• Reconfirm your plan for after the exam: you'll have 5 years from a passing result to formally apply for the CISA certification, so keep your exam confirmation/results paperwork accessible.